GlobalXess
Login Sign up
Legal

Privacy notice

How Global Premium Telecom B.V. (trading as GlobalXess) processes personal data submitted via this website - written so you can read it in five minutes, aligned to the EU General Data Protection Regulation (GDPR).

# 1. Who is responsible for your data

The data controller for personal data collected via this website is:

Global Premium Telecom B.V. ("GlobalXess")
Middelerf 14, 3851 SP Ermelo, The Netherlands
Dutch Chamber of Commerce (KvK): 71556966
VAT: NL858761567B01
Email: support@globalxess.com
Telephone: +31 20 893 8450

We do not currently have a statutory obligation to appoint a Data Protection Officer under Article 37 GDPR. Privacy questions and data subject requests are handled by the operations team, reachable on the email above.

# 2. What we collect and why

We only collect what we need to answer your question or run our service.

Forms on this website

  • Contact form - name, email, company (optional), message.
  • Business sign-up form - company details (registered name, KvK/CoC number, VAT, address), contact person details (name, role, email, phone), and an optional use-case description.
  • ITW Washington 2026 follow-up form - name, company, email, an optional preferred meeting slot and an optional message.

Spam and abuse protection on form pages

The contact, business sign-up and ITW follow-up forms load Google reCAPTCHA v3 in your browser when you open the page. reCAPTCHA analyses interaction signals (for example mouse movement, how long the page was open, and browser characteristics) and returns a risk score to our server when you submit the form. We only accept submissions that score at or above our configured human threshold (currently 0.9 on a 0.0–1.0 scale).

  • Your name, email and message are not sent to Google as part of the reCAPTCHA check — only the token and, on our server, your IP address for verification.
  • Google may set or read cookies and similar storage on its own domains (google.com, gstatic.com) when the script runs. Details are in the cookies notice, § 3.
  • If reCAPTCHA cannot run (for example because you block third-party scripts), the form may refuse to submit and ask you to try again.

In addition, those forms include an invisible honeypot field and a minimum fill-time check handled entirely on our servers — see the glossary for the honeypot technique.

Server-side request data

  • The IP address of the device making the request.
  • The HTTP request line (path, method, status code, response size, duration) and the User-Agent header.
  • A first-party cookie called _xs that holds an opaque ULID. It is used to correlate page-views server-side and is classed as strictly necessary; details are in the cookies notice.

Server-side audience measurement

We use Google Analytics 4 in server-side Measurement Protocol mode only. There is no gtag.js, no Google Tag Manager, no Meta Pixel, no LinkedIn Insight Tag and no behavioural-tracking SDK loaded in your browser. Concretely:

  • Aggregate page-views and a small number of conversion events (form submissions sent to us via the contact, sign-up and ITW pages) are forwarded from our server to Google Analytics over a server-to-server HTTPS request to https://www.google-analytics.com/mp/collect.
  • The client_id we send to Google is a SHA-256-derived pseudonymous identifier seeded from the strictly necessary _xs cookie and a server-side salt. We do not send your name, email, IP address, advertising ID, or any other directly identifying field.
  • We send non_personalized_ads = true on every event, so Google Analytics may not use the data to build advertising audiences.
  • Google Analytics IP-anonymisation is applied automatically to Measurement Protocol traffic.
  • Data is retained in Google Analytics for 14 months. Google signals (cross-device tracking) is disabled for this property.

We do not use third-party advertising tags, retargeting pixels, or behavioural-tracking SDKs on general browsing pages. The only third-party script loaded in your browser is Google reCAPTCHA v3, and only on the three form pages listed above. Aggregate audience measurement uses Google Analytics 4 in server-side Measurement Protocol mode (no gtag.js in the browser). We do not show a cookie consent banner because the first-party cookies we set are strictly necessary or preference-only, and reCAPTCHA is loaded under our legitimate interest in preventing automated abuse of the forms you choose to use — see § 3 and the cookies notice.

# 3. Lawful basis

Per Article 6(1) GDPR our lawful bases are:

  • Article 6(1)(b) - pre-contractual steps: processing of contact-form, ITW form and business sign-up form data, where you are asking us to take steps before potentially entering into a contract.
  • Article 6(1)(f) - legitimate interests: short-term server-side request logs; abuse detection on forms (honeypot fields, minimum fill-time checks, IP rate limits, and Google reCAPTCHA v3 risk scoring); and the strictly-necessary _xs cookie. Our legitimate interest is keeping the website available, secure and free of automated spam. We have weighed this against your right to privacy and only process the minimum necessary for the minimum necessary time. You may object to reCAPTCHA processing under Article 21 — contact us using § 8; note that we may then be unable to accept your form submission online.
  • Article 6(1)(c) - legal obligation: retention of records that we are required by Dutch tax or telecom law to keep (for example invoicing data, where applicable).

We do not rely on consent (Article 6(1)(a)) for anything on this website. The server-side Measurement Protocol pipeline described above runs under Article 6(1)(f) (legitimate interest in understanding which content actually serves visitors, balanced against minimal, pseudonymised payloads with no advertising IDs and no client-side script). Google reCAPTCHA v3 on form pages also runs under Article 6(1)(f) for abuse prevention, not under consent — because it is tied to a specific service you request (submitting a form) rather than cross-site profiling. If you prefer not to interact with reCAPTCHA, email us directly at support@globalxess.com instead of using the online form.

# 4. Recipients and processors

Inside GlobalXess, form submissions are accessible to the sales, operations and engineering staff who need to follow up on them.

The following processors process personal data on our behalf:

  • Slack Technologies LLC (a Salesforce company), USA - we use a Slack incoming webhook to deliver new form submissions to a private internal channel so the team sees them in real time. Slack acts as a processor under the GDPR; the underlying customer-data processing is governed by the Salesforce Data Processing Addendum and the EU Standard Contractual Clauses (see § 5 below).
  • Google LLC, USA — (a) we forward aggregate, pseudonymised page-view and conversion events to Google Analytics 4 via the server-side Measurement Protocol described in § 2; (b) on form pages we load reCAPTCHA v3 in your browser and verify submission tokens on our server via Google's siteverify API. Google acts as a processor for both services; processing is governed by the Google Ads / Cloud Data Processing Terms and the EU Standard Contractual Clauses (see § 5 below). Google's own privacy notice for reCAPTCHA is at policies.google.com/privacy.
  • Cloud-infrastructure providers hosting this website and its supporting services in the European Union under standard infrastructure-as-a-service contracts.

We do not sell your personal data, and we do not share it with advertising networks.

# 5. International transfers

The website itself is operated from infrastructure inside the European Union. Form-submission notifications are delivered to Slack, which is a US-based service. Google Analytics Measurement Protocol traffic and reCAPTCHA verification requests are also processed by Google LLC in the United States. Where personal data leaves the EEA in this way, the transfer is governed by the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) as supplemented by the processor's technical and organisational safeguards. A copy of the SCCs is available from the operator on request.

# 6. How long we keep it

We retain personal data only for as long as we need it for the purpose for which it was collected:

  • Contact-form submissions: up to 24 months after the last contact, to support follow-up conversations and audit. Deleted earlier on request.
  • Business sign-up form: as long as the business relationship is active, then up to 7 years to comply with Dutch commercial bookkeeping retention obligations (Article 2:10 BW / Article 52 AWR) where the data is part of the underlying records.
  • ITW follow-up leads: up to 12 months after the event.
  • Server-side request logs: up to 90 days for operational and security purposes.
  • The _xs cookie: up to 13 months on your device.

# 7. Your rights

Under the GDPR you have the right to:

  • request a copy of the personal data we hold about you (Article 15);
  • have inaccurate data corrected (Article 16);
  • have your data erased where the legal basis no longer applies (Article 17);
  • restrict processing in defined circumstances (Article 18);
  • receive your data in a portable, machine-readable form (Article 20);
  • object to processing based on our legitimate interests (Article 21);
  • lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

# 8. How to exercise your rights

Send a Data Subject Access Request (DSAR) to support@globalxess.com with the subject line "Data subject request". We aim to respond within 30 calendar days, as required by Article 12(3) GDPR. If your request is complex we may extend this by a further two months and we will tell you why.

To protect your data we may ask you to confirm your identity before fulfilling a request. Where the request is for the deletion of an active business contact whose data we are required to retain by law, we will explain which records we must keep and why.

# 9. Changes to this notice

We may update this notice when our processing changes, when a new processor is introduced, or when the law changes. The "Last updated" date in the sidebar always reflects the date of the current version. Material changes are announced in the news/blog section before they take effect.